Edit

OpenTelemetry Guest OS Metrics reference (preview)

This article lists the performance counters that Azure Monitor Agent collects from Windows and Linux virtual machines, along with the OpenTelemetry resource attributes that are automatically added to those metrics. Use it as a reference when you configure a data collection rule (DCR) or explore metrics in Azure Monitor Metrics Explorer.

Performance counters

Azure Monitor Agent collects performance counters for Windows and Linux virtual machines through two paths:

  • OpenTelemetry counters (recommended for new deployments). Grouped below by namespace: CPU, process, disk, memory, network, system, paging, and filesystem.
  • Legacy Windows and Linux performance counters (for VM Insights or DCR configurations that use the classic counter model). Grouped by operating system at the end of this section.

The default sampling frequency is 60 seconds. You can change this frequency when you create or update the data collection rule.

OpenTelemetry CPU counters

CPU counters cover system.cpu.utilization and system.cpu.time (broken down by CPU state and logical CPU), the physical and logical CPU counts (system.cpu.physical.count, system.cpu.logical.count), the 1-minute, 5-minute, and 15-minute load averages (system.cpu.load_average.1m, system.cpu.load_average.5m, system.cpu.load_average.15m), and the current CPU frequency (system.cpu.frequency).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.cpu.utilization Gauge 1 N/A FALSE cpu: Logical CPU number starting at 0 (values: Any Str)
state: Breakdown of CPU usage by type (values: idle, interrupt, nice, softirq, steal, system, user, wait)		 Difference in system.cpu.time since the last measurement per logical CPU, divided by the elapsed time (0–1).
system.cpu.time Sum s Cumulative TRUE cpu: Logical CPU number starting at 0 (values: Any Str)
state: Breakdown of CPU usage by type (values: idle, interrupt, nice, softirq, steal, system, user, wait)		 Total seconds each logical CPU spent on each mode.
system.cpu.physical.count Sum {cpu} Cumulative FALSE (none) Number of available physical CPUs.
system.cpu.logical.count Sum {cpu} Cumulative FALSE cpu: Logical CPU number starting at 0 (values: Any Str) Number of available logical CPUs.
system.cpu.load_average.5m Gauge {thread} N/A FALSE (none) Average CPU Load over 5 minutes.
system.cpu.load_average.1m Gauge {thread} N/A FALSE (none) Average CPU Load over 1 minute.
system.cpu.load_average.15m Gauge {thread} N/A FALSE (none) Average CPU Load over 15 minutes.
system.cpu.frequency Gauge Hz N/A FALSE (none) Current frequency of the CPU core in Hz.

OpenTelemetry process counters — runtime, threads, and faults

Runtime and lifecycle metrics for individual processes: uptime (process.uptime), thread count (process.threads), pending signal count (process.signals_pending, Linux only), paging fault count (process.paging.faults, Linux only), open file descriptor count (process.open_file_descriptors), open handle count (process.handles, Windows only), and context switch count (process.context_switches, Linux only).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
process.uptime Gauge s N/A FALSE (none) Time the process has been running.
process.threads Sum {threads} Cumulative FALSE (none) Process threads count.
process.signals_pending Sum {signals} Cumulative FALSE (none) Number of pending signals for the process (Linux only).
process.paging.faults Sum {faults} Cumulative TRUE type: Type of fault (values: major, minor) Number of page faults the process has made (Linux only).
process.open_file_descriptors Sum {count} Cumulative FALSE (none) Number of file descriptors in use by the process.
process.handles Sum {count} Cumulative FALSE (none) Number of open handles (Windows only).
process.context_switches Sum {count} Cumulative TRUE type: Type of context switch (values: Any Str) Number of times the process has been context switched (Linux only).

OpenTelemetry process counters — CPU, memory, and I/O

Resource-usage metrics for individual processes: virtual memory size (process.memory.virtual), percentage of physical memory used (process.memory.utilization), physical memory in use (process.memory.usage), disk operation count and byte throughput (process.disk.operations, process.disk.io), percentage of CPU time (process.cpu.utilization), and total CPU seconds broken down by state (process.cpu.time).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
process.memory.virtual Sum By Cumulative FALSE (none) Virtual memory size.
process.memory.utilization Gauge 1 N/A FALSE (none) Percentage of total physical memory used by the process.
process.memory.usage Sum By Cumulative FALSE (none) Amount of physical memory in use.
process.disk.operations Sum {operations} Cumulative TRUE direction: Direction of flow (values: read, write) Disk operations performed by the process.
process.disk.io Sum By Cumulative TRUE direction: Direction of flow (values: read, write) Disk bytes transferred.
process.cpu.utilization Gauge 1 N/A FALSE state: Breakdown of CPU usage (values: system, user, wait) Percentage of total CPU time used by the process since last scrape (0–1).
process.cpu.time Sum s Cumulative TRUE state: Breakdown of CPU usage (values: system, user, wait) Total CPU seconds broken down by states.

OpenTelemetry disk counters

Disk activity metrics per device: total bytes transferred (system.disk.io), operation count and elapsed time (system.disk.operations, system.disk.operation_time), pending queue depth (system.disk.pending_operations), merged operation count (system.disk.merged), total activation time (system.disk.io_time), and queue-length-weighted activation time (system.disk.weighted_io_time).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.disk.weighted_io_time Sum s Cumulative FALSE device: Name of the disk (values: Any Str) Time disk spent activated multiplied by queue length.
system.disk.pending_operations Sum {operations} Cumulative FALSE device: Name of the disk (values: Any Str) Queue size of pending I/O operations.
system.disk.operations Sum {operations} Cumulative TRUE device: Name of the disk (values: Any Str)
direction: Direction of flow (values: read, write)		 Disk operations count.
system.disk.operation_time Sum s Cumulative TRUE device: Name of the disk (values: Any Str)
direction: Direction of flow (values: read, write)		 Time spent in disk operations.
system.disk.merged Sum {operations} Cumulative TRUE device: Name of the disk (values: Any Str)
direction: Direction of flow (values: read, write)		 Disk reads/writes merged into single physical operations.
system.disk.io_time Sum s Cumulative TRUE device: Name of the disk (values: Any Str) Time disk spent activated.
system.disk.io Sum By Cumulative TRUE device: Name of the disk (values: Any Str)
direction: Direction of flow (values: read, write)		 Disk bytes transferred.

OpenTelemetry memory counters

Memory usage and configuration metrics: byte and percentage utilization broken down by memory state (system.memory.usage, system.memory.utilization), configured page size (system.memory.page_size), total available memory (system.memory.limit), and Linux-specific dirty and available memory estimates (system.linux.memory.dirty, system.linux.memory.available).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.memory.utilization Gauge 1 N/A FALSE state: Breakdown of memory usage (values: buffered, cached, inactive, free, slab_reclaimable, slab_unreclaimable, used) Percentage of memory bytes in use.
system.memory.usage Sum By Cumulative FALSE state: Breakdown of memory usage (values: buffered, cached, inactive, free, slab_reclaimable, slab_unreclaimable, used) Bytes of memory in use.
system.memory.page_size Gauge By N/A FALSE (none) System's configured page size.
system.memory.limit Sum By Cumulative FALSE (none) Total bytes of memory available.
system.linux.memory.dirty Sum By Cumulative FALSE (none) Amount of dirty memory (/proc/meminfo).
system.linux.memory.available Sum By Cumulative FALSE (none) Estimate of available memory (Linux only).

OpenTelemetry network counters

Network activity metrics per interface: packet count (system.network.packets), byte throughput (system.network.io), error count (system.network.errors), dropped packet count (system.network.dropped), conntrack table entry count and limit (system.network.conntrack.count, system.network.conntrack.max), and open connection count broken down by protocol and state (system.network.connections).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.network.packets Sum {packets} Cumulative TRUE device: Network interface name (values: Any Str)
direction: Direction of flow (values: receive, transmit)		 Number of packets transferred.
system.network.io Sum By Cumulative TRUE (none) Bytes transmitted and received.
system.network.errors Sum {errors} Cumulative FALSE device: Network interface name (values: Any Str)
direction: Direction of flow (values: receive, transmit)		 Number of errors encountered.
system.network.dropped Sum {packets} Cumulative TRUE device: Network interface name (values: Any Str)
direction: Direction of flow (values: receive, transmit)		 Number of packets dropped.
system.network.conntrack.max Sum {entries} Cumulative FALSE (none) Limit for entries in conntrack table.
system.network.conntrack.count Sum {entries} Cumulative FALSE (none) Count of entries in conntrack table.
system.network.connections Sum {connections} Cumulative FALSE protocol: Network protocol (values: tcp)
state: Connection state (values: Any Str)		 Number of connections.

OpenTelemetry system counters

System-wide metrics: total uptime (system.uptime), total processes created (system.processes.created), and current process counts broken down by state (system.processes.count).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.uptime Gauge s N/A FALSE (none) Time the system has been running.
system.processes.created Sum {processes} Cumulative TRUE (none) Total number of created processes.
system.processes.count Sum {processes} Cumulative FALSE status: Process status (values: blocked, daemon, detached, idle, locked, orphan, paging, running, sleeping, stopped, system, unknown, zombies) Total number of processes in each state.

OpenTelemetry paging counters

Swap (Unix) or pagefile (Windows) metrics include byte usage and percentage utilization (system.paging.usage, system.paging.utilization), paging operation count broken down by direction and fault type (system.paging.operations), and total page fault count (system.paging.faults).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.paging.utilization Gauge 1 N/A FALSE device: Page file name (values: Any Str)
state: Paging usage type (values: cached, free, used)		 Swap (Unix) or pagefile (Windows) utilization.
system.paging.usage Sum By Cumulative FALSE device: Page file name (values: Any Str)
state: Paging usage type (values: cached, free, used)		 Swap (Unix) or pagefile (Windows) usage.
system.paging.operations Sum {operations} Cumulative TRUE direction: Page flow (values: page_in, page_out)
type: Fault type (values: major, minor)		 Paging operations.
system.paging.faults Sum {faults} (none) TRUE type: Fault type (values: major, minor) Number of page faults.

OpenTelemetry filesystem counters

Filesystem usage per mounted device includes the fraction of bytes used (system.filesystem.utilization), total bytes used broken down by usage state (system.filesystem.usage), and inode count broken down by usage state (system.filesystem.inodes.usage).

Performance Counter Type Unit Aggregation Monotonic Dimensions Description
system.filesystem.utilization Gauge 1 N/A FALSE device: Filesystem identifier
mode: Mount mode (values: ro, rw)
mountpoint: Path
type: Filesystem type (values: ext4, tmpfs, etc.)		 Fraction of filesystem bytes used.
system.filesystem.usage Sum By Cumulative FALSE device: Filesystem identifier
mode: Mount mode
mountpoint: Path
type: Filesystem type
state: Usage type (values: free, reserved, used)		 Filesystem bytes used.
system.filesystem.inodes.usage Sum {inodes} Cumulative FALSE device: Filesystem identifier
mode: Mount mode
mountpoint: Path
type: Filesystem type
state: Usage type (values: free, reserved, used)		 Filesystem inodes used.

Legacy Windows and Linux performance counters

For VM Insights or DCR configurations that use the classic Windows and Linux performance counter model instead of OpenTelemetry, select the operating system tab.

Windows performance counters collected by Azure Monitor Agent, grouped by category.

Performance Counter Category
\Processor Information(_Total)\% Processor Time CPU
\Processor Information(_Total)\% Privileged Time CPU
\Processor Information(_Total)\% User Time CPU
\Processor Information(_Total)\Processor Frequency CPU
\System\Processes CPU
\Process(_Total)\Thread Count CPU
\Process(_Total)\Handle Count CPU
\System\System Up Time CPU
\System\Context Switches/sec CPU
\System\Processor Queue Length CPU
\Memory\% Committed Bytes In Use Memory
\Memory\Available Bytes Memory
\Memory\Committed Bytes Memory
\Memory\Cache Bytes Memory
\Memory\Pool Paged Bytes Memory
\Memory\Pool Nonpaged Bytes Memory
\Memory\Pages/sec Memory
\Memory\Page Faults/sec Memory
\Process(_Total)\Working Set Memory
\Process(_Total)\Working Set - Private Memory
\LogicalDisk(_Total)\% Disk Time Disk
\LogicalDisk(_Total)\% Disk Read Time Disk
\LogicalDisk(_Total)\% Disk Write Time Disk
\LogicalDisk(_Total)\% Idle Time Disk
\LogicalDisk(_Total)\Disk Bytes/sec Disk
\LogicalDisk(_Total)\Disk Read Bytes/sec Disk
\LogicalDisk(_Total)\Disk Write Bytes/sec Disk
\LogicalDisk(_Total)\Disk Transfers/sec Disk
\LogicalDisk(_Total)\Disk Reads/sec Disk
\LogicalDisk(_Total)\Disk Writes/sec Disk
\LogicalDisk(_Total)\Avg. Disk sec/Transfer Disk
\LogicalDisk(_Total)\Avg. Disk sec/Read Disk
\LogicalDisk(_Total)\Avg. Disk sec/Write Disk
\LogicalDisk(_Total)\Avg. Disk Queue Length Disk
\LogicalDisk(_Total)\Avg. Disk Read Queue Length Disk
\LogicalDisk(_Total)\Avg. Disk Write Queue Length Disk
\LogicalDisk(_Total)\% Free Space Disk
\LogicalDisk(_Total)\Free Megabytes Disk
\Network Interface(*) \Bytes Total/sec Network
\Network Interface(*) \Bytes Sent/sec Network
\Network Interface(*) \Bytes Received/sec Network
\Network Interface(*) \Packets/sec Network
\Network Interface(*) \Packets Sent/sec Network
\Network Interface(*) \Packets Received/sec Network
\Network Interface(*) \Packets Outbound Errors Network
\Network Interface(*) \Packets Received Errors Network

Resource attributes

The OpenTelemetry Resource semantic convention is still in development. The Azure Monitor team is actively engaging with the open-source community to improve and standardize this naming convention for a variety of scenarios. Share your feedback to help continuously improve your experience.

When you collect OpenTelemetry metrics by using Azure Monitor Agent and Data Collection Rules and send them to Azure Monitor workspaces, the solution automatically adds the following cloud resource attributes as dimensions to support resource-scoped querying:

  • Microsoft.resourceid
  • Microsoft.subscriptionid
  • Microsoft.resourcegroupname
  • Microsoft.resourcetype
  • Microsoft.amwresourceid

OpenTelemetry per-process metrics have their own special set of Resource Attributes. The following table shows those resource attributes that the Azure Monitor Agent automatically promotes as dimensions.

Name Description Values Enabled
process.command The command used to launch the process (that is, the command name). On Linux-based systems, set to the zeroth string in proc/[pid]/cmdline. On Windows, set to the first parameter extracted from GetCommandLineW. Any Str true
process.executable.name The name of the process executable. On Linux-based systems, set to the Name in proc/[pid]/status. On Windows, set to the base name of GetProcessImageFileNameW. Any Str true
process.owner The username of the user that owns the process. Any Str true
process.pid Process identifier (PID). Any Int true
process.cgroup cgroup associated with the process (Linux only). Any Str false
process.command_line The full command used to launch the process as a single string representing the full command. On Windows, set to the result of GetCommandLineW. Don't set this attribute if you have to assemble it just for monitoring. Use process.command_args instead. Any Str false
process.executable.path The full path to the process executable. On Linux-based systems, set to the target of proc/[pid]/exe. On Windows, set to the result of GetProcessImageFileNameW. Any Str false
process.parent_pid Parent Process Identifier (PPID). Any Int false

The process.command_line attribute can contain extremely long strings with thousands of characters, making it unsuitable as a normal metric dimension. The product team might find a different way to surface this attribute based on customer user scenarios submitted as feedback.

Next steps

Use custom metrics from various services:

  • Last updated on